@nextclaw/app-runtime 0.9.13 → 0.9.14

package/dist/services/app-bundle.service.js

@@ -0,0 +1,305 @@
+import { AppManifestService } from "./app-manifest.service.js";
+import { isAppComponentManifestBundle, isAppStandaloneManifestBundle } from "../types/app-manifest.types.js";
+import { createHash, randomUUID } from "node:crypto";
+import { access, lstat, mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { strToU8, unzipSync, zipSync } from "fflate";
+//#region src/services/app-bundle.service.ts
+const MAX_COMPRESSED_BYTES = 25 * 1024 * 1024;
+const MAX_UNCOMPRESSED_BYTES = 100 * 1024 * 1024;
+const MAX_FILE_BYTES = 25 * 1024 * 1024;
+const MAX_FILE_COUNT = 2e3;
+const CHECKSUMS_PATH = ".napp/checksums.json";
+const BUNDLE_METADATA_PATH = ".napp/bundle.json";
+var AppBundleService = class {
+	constructor(manifestService = new AppManifestService()) {
+		this.manifestService = manifestService;
+	}
+	packAppDirectory = async (params) => {
+		const { appDirectory, outputPath, mode: requestedMode } = params;
+		const bundle = await this.manifestService.load(appDirectory);
+		const mode = requestedMode ?? "bundle";
+		if (isAppComponentManifestBundle(bundle) && mode !== "bundle") throw new Error("schema v2 组合包只支持 bundle 分发，不允许运行安装脚本。");
+		const { appFiles, filePaths } = mode === "source" ? await this.collectSourceFiles(bundle) : await this.collectRuntimeFiles(bundle);
+		this.assertFileBudgets(appFiles);
+		const metadata = this.buildMetadata(bundle.manifest.id, bundle.manifest.name, bundle.manifest.version, mode);
+		const bundleJsonBytes = strToU8(`${JSON.stringify(metadata, null, 2)}\n`);
+		const checksums = this.buildChecksums({
+			...appFiles,
+			[BUNDLE_METADATA_PATH]: bundleJsonBytes
+		});
+		const checksumsJsonBytes = strToU8(`${JSON.stringify(checksums, null, 2)}\n`);
+		const archiveBytes = zipSync({
+			...appFiles,
+			[BUNDLE_METADATA_PATH]: bundleJsonBytes,
+			[CHECKSUMS_PATH]: checksumsJsonBytes
+		}, { level: 9 });
+		if (archiveBytes.byteLength > MAX_COMPRESSED_BYTES) throw new Error(`bundle 压缩后超过 ${MAX_COMPRESSED_BYTES} bytes 上限。`);
+		const resolvedOutputPath = outputPath ? path.resolve(outputPath) : path.join(path.dirname(bundle.appDirectory), `${this.normalizeBundleFileName(bundle.manifest.id)}-${bundle.manifest.version}.napp`);
+		await mkdir(path.dirname(resolvedOutputPath), { recursive: true });
+		await writeFile(resolvedOutputPath, Buffer.from(archiveBytes));
+		return {
+			bundlePath: resolvedOutputPath,
+			metadata,
+			sizeBytes: archiveBytes.byteLength,
+			filePaths
+		};
+	};
+	extractBundle = async (params) => {
+		const bundlePath = path.resolve(params.bundlePath);
+		const targetDirectory = path.resolve(params.targetDirectory);
+		const { archive, metadata, checksums } = await this.readValidatedArchive(bundlePath);
+		await this.replaceTargetWithArchive({
+			archive,
+			metadata,
+			targetDirectory
+		});
+		return {
+			appDirectory: targetDirectory,
+			metadata,
+			checksums
+		};
+	};
+	readValidatedArchive = async (bundlePath) => {
+		const bundleStats = await stat(bundlePath);
+		if (!bundleStats.isFile() || bundleStats.size > MAX_COMPRESSED_BYTES) throw new Error(`bundle 压缩体积超过 ${MAX_COMPRESSED_BYTES} bytes 上限。`);
+		let fileCount = 0;
+		let totalBytes = 0;
+		const archive = unzipSync(new Uint8Array(await readFile(bundlePath)), { filter: (file) => {
+			fileCount += 1;
+			totalBytes += file.originalSize;
+			if (fileCount > MAX_FILE_COUNT) throw new Error(`bundle 文件数超过 ${MAX_FILE_COUNT} 上限。`);
+			if (file.originalSize > MAX_FILE_BYTES) throw new Error(`bundle 单文件超过 ${MAX_FILE_BYTES} bytes 上限：${file.name}`);
+			if (totalBytes > MAX_UNCOMPRESSED_BYTES) throw new Error(`bundle 解压后超过 ${MAX_UNCOMPRESSED_BYTES} bytes 上限。`);
+			return true;
+		} });
+		const normalizedArchive = this.normalizeArchive(archive);
+		const metadata = this.readMetadataFromArchive(normalizedArchive);
+		const checksums = this.readChecksumsFromArchive(normalizedArchive);
+		this.verifyArchiveChecksums(normalizedArchive, checksums);
+		return {
+			archive: normalizedArchive,
+			metadata,
+			checksums
+		};
+	};
+	replaceTargetWithArchive = async (params) => {
+		const { archive, metadata, targetDirectory } = params;
+		const targetParent = path.dirname(targetDirectory);
+		const operationId = randomUUID();
+		const stagedDirectory = path.join(targetParent, `.${path.basename(targetDirectory)}.extracting-${operationId}`);
+		const backupDirectory = path.join(targetParent, `.${path.basename(targetDirectory)}.backup-${operationId}`);
+		const targetExists = await this.pathExists(targetDirectory);
+		await mkdir(targetParent, { recursive: true });
+		try {
+			await mkdir(stagedDirectory);
+			await this.writeArchiveEntries(archive, stagedDirectory);
+			await this.assertExtractedManifest(stagedDirectory, metadata);
+			if (targetExists) await rename(targetDirectory, backupDirectory);
+			await rename(stagedDirectory, targetDirectory);
+			await rm(backupDirectory, {
+				recursive: true,
+				force: true
+			});
+		} catch (error) {
+			await rm(stagedDirectory, {
+				recursive: true,
+				force: true
+			});
+			if (targetExists && await this.pathExists(backupDirectory)) {
+				await rm(targetDirectory, {
+					recursive: true,
+					force: true
+				});
+				try {
+					await rename(backupDirectory, targetDirectory);
+				} catch (restoreError) {
+					throw new AggregateError([error, restoreError], `bundle 解压失败，且无法恢复原目标目录：${targetDirectory}`);
+				}
+			}
+			throw error;
+		} finally {
+			await rm(stagedDirectory, {
+				recursive: true,
+				force: true
+			});
+			await rm(backupDirectory, {
+				recursive: true,
+				force: true
+			});
+		}
+	};
+	writeArchiveEntries = async (archive, targetDirectory) => {
+		for (const [entryName, bytes] of Object.entries(archive)) {
+			const targetPath = path.join(targetDirectory, entryName);
+			await mkdir(path.dirname(targetPath), { recursive: true });
+			await writeFile(targetPath, Buffer.from(bytes));
+		}
+	};
+	assertExtractedManifest = async (appDirectory, metadata) => {
+		const manifestBundle = await this.manifestService.load(appDirectory);
+		if (metadata.appId !== manifestBundle.manifest.id || metadata.name !== manifestBundle.manifest.name || metadata.version !== manifestBundle.manifest.version) throw new Error("bundle metadata 与 manifest.json 身份不一致。");
+		if (manifestBundle.manifest.schemaVersion === 2 && metadata.distributionMode !== "bundle") throw new Error("schema v2 组合包只支持 bundle 分发。");
+	};
+	collectRuntimeFiles = async (bundle) => {
+		const filePaths = new Set([path.relative(bundle.appDirectory, bundle.manifestPath).replace(/\\/g, "/")]);
+		if (isAppStandaloneManifestBundle(bundle)) {
+			filePaths.add(path.relative(bundle.appDirectory, bundle.mainEntryPath).replace(/\\/g, "/"));
+			await this.collectDirectoryPaths(bundle.uiDirectoryPath, bundle.appDirectory, filePaths);
+			await this.collectDirectoryPaths(bundle.assetsDirectoryPath, bundle.appDirectory, filePaths);
+		} else {
+			for (const component of bundle.components) await this.collectDirectoryPaths(component.componentDirectory, bundle.appDirectory, filePaths);
+			await this.collectDirectoryPaths(bundle.assetsDirectoryPath, bundle.appDirectory, filePaths);
+			await this.addOptionalFile(bundle.appDirectory, "marketplace.json", filePaths);
+		}
+		if (bundle.iconPath) filePaths.add(path.relative(bundle.appDirectory, bundle.iconPath).replace(/\\/g, "/"));
+		return await this.readAppFiles(bundle.appDirectory, filePaths);
+	};
+	collectSourceFiles = async (bundle) => {
+		if (!isAppStandaloneManifestBundle(bundle)) throw new Error("schema v2 组合包不支持 source 分发。");
+		const filePaths = /* @__PURE__ */ new Set();
+		await this.collectSourceDirectoryPaths(bundle.appDirectory, bundle.appDirectory, filePaths);
+		const result = await this.readAppFiles(bundle.appDirectory, filePaths);
+		if (bundle.manifest.main.kind === "wasi-http-component") result.appFiles[bundle.manifest.main.entry] = SOURCE_WASM_PLACEHOLDER_BYTES;
+		return result;
+	};
+	readAppFiles = async (appDirectory, filePaths) => {
+		const sortedPaths = Array.from(filePaths).sort((left, right) => left.localeCompare(right));
+		const appFiles = {};
+		for (const relativePath of sortedPaths) appFiles[relativePath] = new Uint8Array(await readFile(path.join(appDirectory, relativePath)));
+		return {
+			appFiles,
+			filePaths: sortedPaths
+		};
+	};
+	collectDirectoryPaths = async (directoryPath, appDirectory, filePaths) => {
+		try {
+			const entries = await readdir(directoryPath, { withFileTypes: true });
+			for (const entry of entries) {
+				const entryPath = path.join(directoryPath, entry.name);
+				const relativePath = path.relative(appDirectory, entryPath).replace(/\\/g, "/");
+				if ((await lstat(entryPath)).isSymbolicLink()) throw new Error(`bundle 不允许包含符号链接：${relativePath}`);
+				if (entry.isDirectory()) {
+					if (!this.shouldExcludeRuntimePath(relativePath)) await this.collectDirectoryPaths(entryPath, appDirectory, filePaths);
+					continue;
+				}
+				if (entry.isFile() && !this.shouldExcludeRuntimePath(relativePath)) filePaths.add(relativePath);
+			}
+		} catch (error) {
+			if (this.isMissingFileError(error)) return;
+			throw error;
+		}
+	};
+	collectSourceDirectoryPaths = async (directoryPath, appDirectory, filePaths) => {
+		const entries = await readdir(directoryPath, { withFileTypes: true });
+		for (const entry of entries) {
+			const entryPath = path.join(directoryPath, entry.name);
+			const relativePath = path.relative(appDirectory, entryPath).replace(/\\/g, "/");
+			if ((await lstat(entryPath)).isSymbolicLink()) throw new Error(`bundle 不允许包含符号链接：${relativePath}`);
+			if (entry.isDirectory()) {
+				if (!this.shouldExcludeSourcePath(relativePath)) await this.collectSourceDirectoryPaths(entryPath, appDirectory, filePaths);
+			} else if (entry.isFile() && !this.shouldExcludeSourcePath(relativePath)) filePaths.add(relativePath);
+		}
+	};
+	addOptionalFile = async (appDirectory, relativePath, filePaths) => {
+		try {
+			const stats = await lstat(path.join(appDirectory, relativePath));
+			if (stats.isFile() && !stats.isSymbolicLink()) filePaths.add(relativePath);
+		} catch (error) {
+			if (!this.isMissingFileError(error)) throw error;
+		}
+	};
+	shouldExcludeRuntimePath = (relativePath) => {
+		return relativePath.split("/").some((segment) => segment === "node_modules" || segment === ".git" || segment === "coverage" || segment === "tests" || segment === "__tests__" || segment === "fixtures") || /(?:^|\/)\.(?:DS_Store|eslintcache)$/.test(relativePath) || relativePath.endsWith(".map");
+	};
+	shouldExcludeSourcePath = (relativePath) => {
+		return this.shouldExcludeRuntimePath(relativePath) || relativePath === ".napp" || relativePath.startsWith(".napp/") || relativePath === "main/dist" || relativePath.startsWith("main/dist/") || relativePath === "main/generated" || relativePath.startsWith("main/generated/");
+	};
+	assertFileBudgets = (files) => {
+		const entries = Object.entries(files);
+		if (entries.length + 2 > MAX_FILE_COUNT) throw new Error(`bundle 文件数超过 ${MAX_FILE_COUNT} 上限。`);
+		let totalBytes = 0;
+		for (const [relativePath, bytes] of entries) {
+			if (bytes.byteLength > MAX_FILE_BYTES) throw new Error(`bundle 单文件超过 ${MAX_FILE_BYTES} bytes 上限：${relativePath}`);
+			totalBytes += bytes.byteLength;
+		}
+		if (totalBytes > MAX_UNCOMPRESSED_BYTES) throw new Error(`bundle 解压后超过 ${MAX_UNCOMPRESSED_BYTES} bytes 上限。`);
+	};
+	normalizeArchive = (archive) => {
+		const normalizedArchive = {};
+		for (const [entryName, bytes] of Object.entries(archive)) {
+			const normalizedEntry = this.normalizeArchiveEntry(entryName);
+			if (Object.hasOwn(normalizedArchive, normalizedEntry)) throw new Error(`bundle 包含重复路径：${normalizedEntry}`);
+			normalizedArchive[normalizedEntry] = bytes;
+		}
+		return normalizedArchive;
+	};
+	readMetadataFromArchive = (archive) => {
+		const raw = this.readJsonArchiveEntry(archive, BUNDLE_METADATA_PATH, "bundle metadata");
+		const distributionMode = raw.distributionMode === void 0 ? "bundle" : raw.distributionMode;
+		if (raw.bundleFormatVersion !== 1 || distributionMode !== "bundle" && distributionMode !== "source" || typeof raw.appId !== "string" || !raw.appId || typeof raw.name !== "string" || !raw.name || typeof raw.version !== "string" || !raw.version || raw.entryManifest !== "manifest.json" || raw.checksumsFile !== CHECKSUMS_PATH) throw new Error("bundle metadata 无效。");
+		return {
+			...raw,
+			distributionMode
+		};
+	};
+	readChecksumsFromArchive = (archive) => {
+		const raw = this.readJsonArchiveEntry(archive, CHECKSUMS_PATH, "bundle checksums");
+		if (raw.algorithm !== "sha256" || !raw.files || typeof raw.files !== "object") throw new Error("bundle checksums 无效。");
+		return raw;
+	};
+	verifyArchiveChecksums = (archive, checksums) => {
+		const actualPaths = Object.keys(archive).filter((entry) => entry !== CHECKSUMS_PATH).sort((left, right) => left.localeCompare(right));
+		const checksumPaths = Object.keys(checksums.files).map((entry) => this.normalizeArchiveEntry(entry)).sort((left, right) => left.localeCompare(right));
+		if (actualPaths.length !== checksumPaths.length || actualPaths.some((entry, index) => entry !== checksumPaths[index])) throw new Error("bundle checksums 必须精确覆盖所有 artifact 文件。");
+		for (const relativePath of actualPaths) {
+			const expectedHash = checksums.files[relativePath];
+			if (!expectedHash || !/^[a-f0-9]{64}$/.test(expectedHash)) throw new Error(`bundle checksum 格式无效：${relativePath}`);
+			if (this.computeSha256(archive[relativePath]) !== expectedHash) throw new Error(`bundle checksum 校验失败：${relativePath}`);
+		}
+	};
+	readJsonArchiveEntry = (archive, entryPath, label) => {
+		const bytes = archive[entryPath];
+		if (!bytes) throw new Error(`bundle 缺少 ${label}。`);
+		try {
+			return JSON.parse(Buffer.from(bytes).toString("utf-8"));
+		} catch (error) {
+			throw new Error(`无法读取 ${label}：${error instanceof Error ? error.message : String(error)}`);
+		}
+	};
+	buildMetadata = (appId, name, version, distributionMode) => ({
+		bundleFormatVersion: 1,
+		distributionMode,
+		appId,
+		name,
+		version,
+		entryManifest: "manifest.json",
+		checksumsFile: CHECKSUMS_PATH
+	});
+	buildChecksums = (files) => ({
+		algorithm: "sha256",
+		files: Object.fromEntries(Object.entries(files).sort(([left], [right]) => left.localeCompare(right)).map(([relativePath, fileBytes]) => [relativePath, this.computeSha256(fileBytes)]))
+	});
+	computeSha256 = (fileBytes) => createHash("sha256").update(Buffer.from(fileBytes)).digest("hex");
+	normalizeBundleFileName = (appId) => appId.replace(/[^a-zA-Z0-9._-]+/g, "-");
+	normalizeArchiveEntry = (entryName) => {
+		const normalized = entryName.replace(/\\/g, "/");
+		const segments = normalized.split("/");
+		if (!normalized || normalized.startsWith("/") || normalized.includes("\0") || /^[A-Za-z]:/.test(normalized) || segments.some((segment) => !segment || segment === "." || segment === "..")) throw new Error(`bundle 内包含非法路径：${entryName}`);
+		return segments.join("/");
+	};
+	isMissingFileError = (error) => typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+	pathExists = async (targetPath) => {
+		try {
+			await access(targetPath);
+			return true;
+		} catch {
+			return false;
+		}
+	};
+};
+const SOURCE_WASM_PLACEHOLDER_BYTES = Uint8Array.from(Buffer.from("AGFzbQEAAAABBwFgAn9/AX8DAgEABxMBD3N1bW1hcml6ZV9ub3RlcwAACg0BCwAgACABakHIAWoL", "base64"));
+//#endregion
+export { AppBundleService };
+
+//# sourceMappingURL=app-bundle.service.js.map

package/dist/services/app-bundle.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-bundle.service.js","names":[],"sources":["../../src/services/app-bundle.service.ts"],"sourcesContent":["import { createHash, randomUUID } from \"node:crypto\";\nimport { access, lstat, mkdir, readFile, readdir, rename, rm, stat, writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { strToU8, unzipSync, zipSync } from \"fflate\";\nimport { AppManifestService } from \"#app-runtime/services/app-manifest.service.js\";\nimport {\n  isAppComponentManifestBundle,\n  isAppStandaloneManifestBundle,\n  type AppManifestBundle,\n} from \"#app-runtime/types/app-manifest.types.js\";\nimport type {\n  AppBundleChecksums,\n  AppBundleExtractResult,\n  AppBundleMetadata,\n  AppBundlePackResult,\n  AppDistributionMode,\n} from \"#app-runtime/types/app-bundle.types.js\";\n\nconst MAX_COMPRESSED_BYTES = 25 * 1024 * 1024;\nconst MAX_UNCOMPRESSED_BYTES = 100 * 1024 * 1024;\nconst MAX_FILE_BYTES = 25 * 1024 * 1024;\nconst MAX_FILE_COUNT = 2_000;\nconst CHECKSUMS_PATH = \".napp/checksums.json\";\nconst BUNDLE_METADATA_PATH = \".napp/bundle.json\";\n\nexport class AppBundleService {\n  constructor(\n    private readonly manifestService: AppManifestService = new AppManifestService(),\n  ) {}\n\n  packAppDirectory = async (params: {\n    appDirectory: string;\n    outputPath?: string;\n    mode?: AppDistributionMode;\n  }): Promise<AppBundlePackResult> => {\n    const { appDirectory, outputPath, mode: requestedMode } = params;\n    const bundle = await this.manifestService.load(appDirectory);\n    const mode = requestedMode ?? \"bundle\";\n    if (isAppComponentManifestBundle(bundle) && mode !== \"bundle\") {\n      throw new Error(\"schema v2 组合包只支持 bundle 分发，不允许运行安装脚本。\");\n    }\n    const { appFiles, filePaths } = mode === \"source\"\n      ? await this.collectSourceFiles(bundle)\n      : await this.collectRuntimeFiles(bundle);\n    this.assertFileBudgets(appFiles);\n    const metadata = this.buildMetadata(\n      bundle.manifest.id,\n      bundle.manifest.name,\n      bundle.manifest.version,\n      mode,\n    );\n    const bundleJsonBytes = strToU8(`${JSON.stringify(metadata, null, 2)}\\n`);\n    const checksums = this.buildChecksums({\n      ...appFiles,\n      [BUNDLE_METADATA_PATH]: bundleJsonBytes,\n    });\n    const checksumsJsonBytes = strToU8(`${JSON.stringify(checksums, null, 2)}\\n`);\n    const archiveBytes = zipSync(\n      {\n        ...appFiles,\n        [BUNDLE_METADATA_PATH]: bundleJsonBytes,\n        [CHECKSUMS_PATH]: checksumsJsonBytes,\n      },\n      { level: 9 },\n    );\n    if (archiveBytes.byteLength > MAX_COMPRESSED_BYTES) {\n      throw new Error(`bundle 压缩后超过 ${MAX_COMPRESSED_BYTES} bytes 上限。`);\n    }\n    const resolvedOutputPath = outputPath\n      ? path.resolve(outputPath)\n      : path.join(\n          path.dirname(bundle.appDirectory),\n          `${this.normalizeBundleFileName(bundle.manifest.id)}-${bundle.manifest.version}.napp`,\n        );\n    await mkdir(path.dirname(resolvedOutputPath), { recursive: true });\n    await writeFile(resolvedOutputPath, Buffer.from(archiveBytes));\n    return {\n      bundlePath: resolvedOutputPath,\n      metadata,\n      sizeBytes: archiveBytes.byteLength,\n      filePaths,\n    };\n  };\n\n  extractBundle = async (params: {\n    bundlePath: string;\n    targetDirectory: string;\n  }): Promise<AppBundleExtractResult> => {\n    const bundlePath = path.resolve(params.bundlePath);\n    const targetDirectory = path.resolve(params.targetDirectory);\n    const { archive, metadata, checksums } = await this.readValidatedArchive(bundlePath);\n    await this.replaceTargetWithArchive({ archive, metadata, targetDirectory });\n    return { appDirectory: targetDirectory, metadata, checksums };\n  };\n\n  private readValidatedArchive = async (bundlePath: string): Promise<{\n    archive: Record<string, Uint8Array>;\n    metadata: AppBundleMetadata;\n    checksums: AppBundleChecksums;\n  }> => {\n    const bundleStats = await stat(bundlePath);\n    if (!bundleStats.isFile() || bundleStats.size > MAX_COMPRESSED_BYTES) {\n      throw new Error(`bundle 压缩体积超过 ${MAX_COMPRESSED_BYTES} bytes 上限。`);\n    }\n    let fileCount = 0;\n    let totalBytes = 0;\n    const archive = unzipSync(new Uint8Array(await readFile(bundlePath)), {\n      filter: (file) => {\n        fileCount += 1;\n        totalBytes += file.originalSize;\n        if (fileCount > MAX_FILE_COUNT) {\n          throw new Error(`bundle 文件数超过 ${MAX_FILE_COUNT} 上限。`);\n        }\n        if (file.originalSize > MAX_FILE_BYTES) {\n          throw new Error(`bundle 单文件超过 ${MAX_FILE_BYTES} bytes 上限：${file.name}`);\n        }\n        if (totalBytes > MAX_UNCOMPRESSED_BYTES) {\n          throw new Error(`bundle 解压后超过 ${MAX_UNCOMPRESSED_BYTES} bytes 上限。`);\n        }\n        return true;\n      },\n    });\n    const normalizedArchive = this.normalizeArchive(archive);\n    const metadata = this.readMetadataFromArchive(normalizedArchive);\n    const checksums = this.readChecksumsFromArchive(normalizedArchive);\n    this.verifyArchiveChecksums(normalizedArchive, checksums);\n    return { archive: normalizedArchive, metadata, checksums };\n  };\n\n  private replaceTargetWithArchive = async (params: {\n    archive: Record<string, Uint8Array>;\n    metadata: AppBundleMetadata;\n    targetDirectory: string;\n  }): Promise<void> => {\n    const { archive, metadata, targetDirectory } = params;\n    const targetParent = path.dirname(targetDirectory);\n    const operationId = randomUUID();\n    const stagedDirectory = path.join(\n      targetParent,\n      `.${path.basename(targetDirectory)}.extracting-${operationId}`,\n    );\n    const backupDirectory = path.join(\n      targetParent,\n      `.${path.basename(targetDirectory)}.backup-${operationId}`,\n    );\n    const targetExists = await this.pathExists(targetDirectory);\n    await mkdir(targetParent, { recursive: true });\n    try {\n      await mkdir(stagedDirectory);\n      await this.writeArchiveEntries(archive, stagedDirectory);\n      await this.assertExtractedManifest(stagedDirectory, metadata);\n      if (targetExists) {\n        await rename(targetDirectory, backupDirectory);\n      }\n      await rename(stagedDirectory, targetDirectory);\n      await rm(backupDirectory, { recursive: true, force: true });\n    } catch (error) {\n      await rm(stagedDirectory, { recursive: true, force: true });\n      if (targetExists && await this.pathExists(backupDirectory)) {\n        await rm(targetDirectory, { recursive: true, force: true });\n        try {\n          await rename(backupDirectory, targetDirectory);\n        } catch (restoreError) {\n          throw new AggregateError(\n            [error, restoreError],\n            `bundle 解压失败，且无法恢复原目标目录：${targetDirectory}`,\n          );\n        }\n      }\n      throw error;\n    } finally {\n      await rm(stagedDirectory, { recursive: true, force: true });\n      await rm(backupDirectory, { recursive: true, force: true });\n    }\n  };\n\n  private writeArchiveEntries = async (\n    archive: Record<string, Uint8Array>,\n    targetDirectory: string,\n  ): Promise<void> => {\n    for (const [entryName, bytes] of Object.entries(archive)) {\n      const targetPath = path.join(targetDirectory, entryName);\n      await mkdir(path.dirname(targetPath), { recursive: true });\n      await writeFile(targetPath, Buffer.from(bytes));\n    }\n  };\n\n  private assertExtractedManifest = async (\n    appDirectory: string,\n    metadata: AppBundleMetadata,\n  ): Promise<void> => {\n    const manifestBundle = await this.manifestService.load(appDirectory);\n    if (\n      metadata.appId !== manifestBundle.manifest.id ||\n      metadata.name !== manifestBundle.manifest.name ||\n      metadata.version !== manifestBundle.manifest.version\n    ) {\n      throw new Error(\"bundle metadata 与 manifest.json 身份不一致。\");\n    }\n    if (manifestBundle.manifest.schemaVersion === 2 && metadata.distributionMode !== \"bundle\") {\n      throw new Error(\"schema v2 组合包只支持 bundle 分发。\");\n    }\n  };\n\n  private collectRuntimeFiles = async (\n    bundle: AppManifestBundle,\n  ): Promise<{ appFiles: Record<string, Uint8Array>; filePaths: string[] }> => {\n    const filePaths = new Set<string>([\n      path.relative(bundle.appDirectory, bundle.manifestPath).replace(/\\\\/g, \"/\"),\n    ]);\n    if (isAppStandaloneManifestBundle(bundle)) {\n      filePaths.add(path.relative(bundle.appDirectory, bundle.mainEntryPath).replace(/\\\\/g, \"/\"));\n      await this.collectDirectoryPaths(bundle.uiDirectoryPath, bundle.appDirectory, filePaths);\n      await this.collectDirectoryPaths(bundle.assetsDirectoryPath, bundle.appDirectory, filePaths);\n    } else {\n      for (const component of bundle.components) {\n        await this.collectDirectoryPaths(component.componentDirectory, bundle.appDirectory, filePaths);\n      }\n      await this.collectDirectoryPaths(bundle.assetsDirectoryPath, bundle.appDirectory, filePaths);\n      await this.addOptionalFile(bundle.appDirectory, \"marketplace.json\", filePaths);\n    }\n    if (bundle.iconPath) {\n      filePaths.add(path.relative(bundle.appDirectory, bundle.iconPath).replace(/\\\\/g, \"/\"));\n    }\n    return await this.readAppFiles(bundle.appDirectory, filePaths);\n  };\n\n  private collectSourceFiles = async (\n    bundle: AppManifestBundle,\n  ): Promise<{ appFiles: Record<string, Uint8Array>; filePaths: string[] }> => {\n    if (!isAppStandaloneManifestBundle(bundle)) {\n      throw new Error(\"schema v2 组合包不支持 source 分发。\");\n    }\n    const filePaths = new Set<string>();\n    await this.collectSourceDirectoryPaths(bundle.appDirectory, bundle.appDirectory, filePaths);\n    const result = await this.readAppFiles(bundle.appDirectory, filePaths);\n    if (bundle.manifest.main.kind === \"wasi-http-component\") {\n      result.appFiles[bundle.manifest.main.entry] = SOURCE_WASM_PLACEHOLDER_BYTES;\n    }\n    return result;\n  };\n\n  private readAppFiles = async (\n    appDirectory: string,\n    filePaths: Set<string>,\n  ): Promise<{ appFiles: Record<string, Uint8Array>; filePaths: string[] }> => {\n    const sortedPaths = Array.from(filePaths).sort((left, right) => left.localeCompare(right));\n    const appFiles: Record<string, Uint8Array> = {};\n    for (const relativePath of sortedPaths) {\n      appFiles[relativePath] = new Uint8Array(await readFile(path.join(appDirectory, relativePath)));\n    }\n    return { appFiles, filePaths: sortedPaths };\n  };\n\n  private collectDirectoryPaths = async (\n    directoryPath: string,\n    appDirectory: string,\n    filePaths: Set<string>,\n  ): Promise<void> => {\n    try {\n      const entries = await readdir(directoryPath, { withFileTypes: true });\n      for (const entry of entries) {\n        const entryPath = path.join(directoryPath, entry.name);\n        const relativePath = path.relative(appDirectory, entryPath).replace(/\\\\/g, \"/\");\n        const entryStats = await lstat(entryPath);\n        if (entryStats.isSymbolicLink()) {\n          throw new Error(`bundle 不允许包含符号链接：${relativePath}`);\n        }\n        if (entry.isDirectory()) {\n          if (!this.shouldExcludeRuntimePath(relativePath)) {\n            await this.collectDirectoryPaths(entryPath, appDirectory, filePaths);\n          }\n          continue;\n        }\n        if (entry.isFile() && !this.shouldExcludeRuntimePath(relativePath)) {\n          filePaths.add(relativePath);\n        }\n      }\n    } catch (error) {\n      if (this.isMissingFileError(error)) {\n        return;\n      }\n      throw error;\n    }\n  };\n\n  private collectSourceDirectoryPaths = async (\n    directoryPath: string,\n    appDirectory: string,\n    filePaths: Set<string>,\n  ): Promise<void> => {\n    const entries = await readdir(directoryPath, { withFileTypes: true });\n    for (const entry of entries) {\n      const entryPath = path.join(directoryPath, entry.name);\n      const relativePath = path.relative(appDirectory, entryPath).replace(/\\\\/g, \"/\");\n      const entryStats = await lstat(entryPath);\n      if (entryStats.isSymbolicLink()) {\n        throw new Error(`bundle 不允许包含符号链接：${relativePath}`);\n      }\n      if (entry.isDirectory()) {\n        if (!this.shouldExcludeSourcePath(relativePath)) {\n          await this.collectSourceDirectoryPaths(entryPath, appDirectory, filePaths);\n        }\n      } else if (entry.isFile() && !this.shouldExcludeSourcePath(relativePath)) {\n        filePaths.add(relativePath);\n      }\n    }\n  };\n\n  private addOptionalFile = async (\n    appDirectory: string,\n    relativePath: string,\n    filePaths: Set<string>,\n  ): Promise<void> => {\n    try {\n      const stats = await lstat(path.join(appDirectory, relativePath));\n      if (stats.isFile() && !stats.isSymbolicLink()) {\n        filePaths.add(relativePath);\n      }\n    } catch (error) {\n      if (!this.isMissingFileError(error)) {\n        throw error;\n      }\n    }\n  };\n\n  private shouldExcludeRuntimePath = (relativePath: string): boolean => {\n    const segments = relativePath.split(\"/\");\n    return segments.some((segment) =>\n      segment === \"node_modules\" ||\n      segment === \".git\" ||\n      segment === \"coverage\" ||\n      segment === \"tests\" ||\n      segment === \"__tests__\" ||\n      segment === \"fixtures\"\n    ) || /(?:^|\\/)\\.(?:DS_Store|eslintcache)$/.test(relativePath) || relativePath.endsWith(\".map\");\n  };\n\n  private shouldExcludeSourcePath = (relativePath: string): boolean => {\n    return this.shouldExcludeRuntimePath(relativePath) ||\n      relativePath === \".napp\" || relativePath.startsWith(\".napp/\") ||\n      relativePath === \"main/dist\" || relativePath.startsWith(\"main/dist/\") ||\n      relativePath === \"main/generated\" || relativePath.startsWith(\"main/generated/\");\n  };\n\n  private assertFileBudgets = (files: Record<string, Uint8Array>): void => {\n    const entries = Object.entries(files);\n    if (entries.length + 2 > MAX_FILE_COUNT) {\n      throw new Error(`bundle 文件数超过 ${MAX_FILE_COUNT} 上限。`);\n    }\n    let totalBytes = 0;\n    for (const [relativePath, bytes] of entries) {\n      if (bytes.byteLength > MAX_FILE_BYTES) {\n        throw new Error(`bundle 单文件超过 ${MAX_FILE_BYTES} bytes 上限：${relativePath}`);\n      }\n      totalBytes += bytes.byteLength;\n    }\n    if (totalBytes > MAX_UNCOMPRESSED_BYTES) {\n      throw new Error(`bundle 解压后超过 ${MAX_UNCOMPRESSED_BYTES} bytes 上限。`);\n    }\n  };\n\n  private normalizeArchive = (\n    archive: Record<string, Uint8Array>,\n  ): Record<string, Uint8Array> => {\n    const normalizedArchive: Record<string, Uint8Array> = {};\n    for (const [entryName, bytes] of Object.entries(archive)) {\n      const normalizedEntry = this.normalizeArchiveEntry(entryName);\n      if (Object.hasOwn(normalizedArchive, normalizedEntry)) {\n        throw new Error(`bundle 包含重复路径：${normalizedEntry}`);\n      }\n      normalizedArchive[normalizedEntry] = bytes;\n    }\n    return normalizedArchive;\n  };\n\n  private readMetadataFromArchive = (\n    archive: Record<string, Uint8Array>,\n  ): AppBundleMetadata => {\n    const raw = this.readJsonArchiveEntry<Partial<AppBundleMetadata>>(\n      archive,\n      BUNDLE_METADATA_PATH,\n      \"bundle metadata\",\n    );\n    const distributionMode = raw.distributionMode === undefined\n      ? \"bundle\"\n      : raw.distributionMode;\n    if (\n      raw.bundleFormatVersion !== 1 ||\n      (distributionMode !== \"bundle\" && distributionMode !== \"source\") ||\n      typeof raw.appId !== \"string\" || !raw.appId ||\n      typeof raw.name !== \"string\" || !raw.name ||\n      typeof raw.version !== \"string\" || !raw.version ||\n      raw.entryManifest !== \"manifest.json\" ||\n      raw.checksumsFile !== CHECKSUMS_PATH\n    ) {\n      throw new Error(\"bundle metadata 无效。\");\n    }\n    return {\n      ...raw,\n      distributionMode,\n    } as AppBundleMetadata;\n  };\n\n  private readChecksumsFromArchive = (\n    archive: Record<string, Uint8Array>,\n  ): AppBundleChecksums => {\n    const raw = this.readJsonArchiveEntry<Partial<AppBundleChecksums>>(\n      archive,\n      CHECKSUMS_PATH,\n      \"bundle checksums\",\n    );\n    if (raw.algorithm !== \"sha256\" || !raw.files || typeof raw.files !== \"object\") {\n      throw new Error(\"bundle checksums 无效。\");\n    }\n    return raw as AppBundleChecksums;\n  };\n\n  private verifyArchiveChecksums = (\n    archive: Record<string, Uint8Array>,\n    checksums: AppBundleChecksums,\n  ): void => {\n    const actualPaths = Object.keys(archive)\n      .filter((entry) => entry !== CHECKSUMS_PATH)\n      .sort((left, right) => left.localeCompare(right));\n    const checksumPaths = Object.keys(checksums.files)\n      .map((entry) => this.normalizeArchiveEntry(entry))\n      .sort((left, right) => left.localeCompare(right));\n    if (\n      actualPaths.length !== checksumPaths.length ||\n      actualPaths.some((entry, index) => entry !== checksumPaths[index])\n    ) {\n      throw new Error(\"bundle checksums 必须精确覆盖所有 artifact 文件。\");\n    }\n    for (const relativePath of actualPaths) {\n      const expectedHash = checksums.files[relativePath];\n      if (!expectedHash || !/^[a-f0-9]{64}$/.test(expectedHash)) {\n        throw new Error(`bundle checksum 格式无效：${relativePath}`);\n      }\n      const actualHash = this.computeSha256(archive[relativePath] as Uint8Array);\n      if (actualHash !== expectedHash) {\n        throw new Error(`bundle checksum 校验失败：${relativePath}`);\n      }\n    }\n  };\n\n  private readJsonArchiveEntry = <T>(\n    archive: Record<string, Uint8Array>,\n    entryPath: string,\n    label: string,\n  ): T => {\n    const bytes = archive[entryPath];\n    if (!bytes) {\n      throw new Error(`bundle 缺少 ${label}。`);\n    }\n    try {\n      return JSON.parse(Buffer.from(bytes).toString(\"utf-8\")) as T;\n    } catch (error) {\n      throw new Error(`无法读取 ${label}：${error instanceof Error ? error.message : String(error)}`);\n    }\n  };\n\n  private buildMetadata = (\n    appId: string,\n    name: string,\n    version: string,\n    distributionMode: AppDistributionMode,\n  ): AppBundleMetadata => ({\n    bundleFormatVersion: 1,\n    distributionMode,\n    appId,\n    name,\n    version,\n    entryManifest: \"manifest.json\",\n    checksumsFile: CHECKSUMS_PATH,\n  });\n\n  private buildChecksums = (files: Record<string, Uint8Array>): AppBundleChecksums => ({\n    algorithm: \"sha256\",\n    files: Object.fromEntries(\n      Object.entries(files)\n        .sort(([left], [right]) => left.localeCompare(right))\n        .map(([relativePath, fileBytes]) => [relativePath, this.computeSha256(fileBytes)]),\n    ),\n  });\n\n  private computeSha256 = (fileBytes: Uint8Array): string =>\n    createHash(\"sha256\").update(Buffer.from(fileBytes)).digest(\"hex\");\n\n  private normalizeBundleFileName = (appId: string): string =>\n    appId.replace(/[^a-zA-Z0-9._-]+/g, \"-\");\n\n  private normalizeArchiveEntry = (entryName: string): string => {\n    const normalized = entryName.replace(/\\\\/g, \"/\");\n    const segments = normalized.split(\"/\");\n    if (\n      !normalized || normalized.startsWith(\"/\") || normalized.includes(\"\\0\") ||\n      /^[A-Za-z]:/.test(normalized) ||\n      segments.some((segment) => !segment || segment === \".\" || segment === \"..\")\n    ) {\n      throw new Error(`bundle 内包含非法路径：${entryName}`);\n    }\n    return segments.join(\"/\");\n  };\n\n  private isMissingFileError = (error: unknown): boolean =>\n    typeof error === \"object\" && error !== null &&\n    \"code\" in error && (error as { code?: unknown }).code === \"ENOENT\";\n\n  private pathExists = async (targetPath: string): Promise<boolean> => {\n    try {\n      await access(targetPath);\n      return true;\n    } catch {\n      return false;\n    }\n  };\n}\n\nconst SOURCE_WASM_PLACEHOLDER_BYTES = Uint8Array.from(\n  Buffer.from(\n    \"AGFzbQEAAAABBwFgAn9/AX8DAgEABxMBD3N1bW1hcml6ZV9ub3RlcwAACg0BCwAgACABakHIAWoL\",\n    \"base64\",\n  ),\n);\n"],"mappings":";;;;;;;AAkBA,MAAM,uBAAuB,KAAK,OAAO;AACzC,MAAM,yBAAyB,MAAM,OAAO;AAC5C,MAAM,iBAAiB,KAAK,OAAO;AACnC,MAAM,iBAAiB;AACvB,MAAM,iBAAiB;AACvB,MAAM,uBAAuB;AAE7B,IAAa,mBAAb,MAA8B;CAC5B,YACE,kBAAuD,IAAI,oBAAoB,EAC/E;AADiB,OAAA,kBAAA;;CAGnB,mBAAmB,OAAO,WAIU;EAClC,MAAM,EAAE,cAAc,YAAY,MAAM,kBAAkB;EAC1D,MAAM,SAAS,MAAM,KAAK,gBAAgB,KAAK,aAAa;EAC5D,MAAM,OAAO,iBAAiB;AAC9B,MAAI,6BAA6B,OAAO,IAAI,SAAS,SACnD,OAAM,IAAI,MAAM,wCAAwC;EAE1D,MAAM,EAAE,UAAU,cAAc,SAAS,WACrC,MAAM,KAAK,mBAAmB,OAAO,GACrC,MAAM,KAAK,oBAAoB,OAAO;AAC1C,OAAK,kBAAkB,SAAS;EAChC,MAAM,WAAW,KAAK,cACpB,OAAO,SAAS,IAChB,OAAO,SAAS,MAChB,OAAO,SAAS,SAChB,KACD;EACD,MAAM,kBAAkB,QAAQ,GAAG,KAAK,UAAU,UAAU,MAAM,EAAE,CAAC,IAAI;EACzE,MAAM,YAAY,KAAK,eAAe;GACpC,GAAG;IACF,uBAAuB;GACzB,CAAC;EACF,MAAM,qBAAqB,QAAQ,GAAG,KAAK,UAAU,WAAW,MAAM,EAAE,CAAC,IAAI;EAC7E,MAAM,eAAe,QACnB;GACE,GAAG;IACF,uBAAuB;IACvB,iBAAiB;GACnB,EACD,EAAE,OAAO,GAAG,CACb;AACD,MAAI,aAAa,aAAa,qBAC5B,OAAM,IAAI,MAAM,gBAAgB,qBAAqB,YAAY;EAEnE,MAAM,qBAAqB,aACvB,KAAK,QAAQ,WAAW,GACxB,KAAK,KACH,KAAK,QAAQ,OAAO,aAAa,EACjC,GAAG,KAAK,wBAAwB,OAAO,SAAS,GAAG,CAAC,GAAG,OAAO,SAAS,QAAQ,OAChF;AACL,QAAM,MAAM,KAAK,QAAQ,mBAAmB,EAAE,EAAE,WAAW,MAAM,CAAC;AAClE,QAAM,UAAU,oBAAoB,OAAO,KAAK,aAAa,CAAC;AAC9D,SAAO;GACL,YAAY;GACZ;GACA,WAAW,aAAa;GACxB;GACD;;CAGH,gBAAgB,OAAO,WAGgB;EACrC,MAAM,aAAa,KAAK,QAAQ,OAAO,WAAW;EAClD,MAAM,kBAAkB,KAAK,QAAQ,OAAO,gBAAgB;EAC5D,MAAM,EAAE,SAAS,UAAU,cAAc,MAAM,KAAK,qBAAqB,WAAW;AACpF,QAAM,KAAK,yBAAyB;GAAE;GAAS;GAAU;GAAiB,CAAC;AAC3E,SAAO;GAAE,cAAc;GAAiB;GAAU;GAAW;;CAG/D,uBAA+B,OAAO,eAIhC;EACJ,MAAM,cAAc,MAAM,KAAK,WAAW;AAC1C,MAAI,CAAC,YAAY,QAAQ,IAAI,YAAY,OAAO,qBAC9C,OAAM,IAAI,MAAM,iBAAiB,qBAAqB,YAAY;EAEpE,IAAI,YAAY;EAChB,IAAI,aAAa;EACjB,MAAM,UAAU,UAAU,IAAI,WAAW,MAAM,SAAS,WAAW,CAAC,EAAE,EACpE,SAAS,SAAS;AAChB,gBAAa;AACb,iBAAc,KAAK;AACnB,OAAI,YAAY,eACd,OAAM,IAAI,MAAM,gBAAgB,eAAe,MAAM;AAEvD,OAAI,KAAK,eAAe,eACtB,OAAM,IAAI,MAAM,gBAAgB,eAAe,YAAY,KAAK,OAAO;AAEzE,OAAI,aAAa,uBACf,OAAM,IAAI,MAAM,gBAAgB,uBAAuB,YAAY;AAErE,UAAO;KAEV,CAAC;EACF,MAAM,oBAAoB,KAAK,iBAAiB,QAAQ;EACxD,MAAM,WAAW,KAAK,wBAAwB,kBAAkB;EAChE,MAAM,YAAY,KAAK,yBAAyB,kBAAkB;AAClE,OAAK,uBAAuB,mBAAmB,UAAU;AACzD,SAAO;GAAE,SAAS;GAAmB;GAAU;GAAW;;CAG5D,2BAAmC,OAAO,WAIrB;EACnB,MAAM,EAAE,SAAS,UAAU,oBAAoB;EAC/C,MAAM,eAAe,KAAK,QAAQ,gBAAgB;EAClD,MAAM,cAAc,YAAY;EAChC,MAAM,kBAAkB,KAAK,KAC3B,cACA,IAAI,KAAK,SAAS,gBAAgB,CAAC,cAAc,cAClD;EACD,MAAM,kBAAkB,KAAK,KAC3B,cACA,IAAI,KAAK,SAAS,gBAAgB,CAAC,UAAU,cAC9C;EACD,MAAM,eAAe,MAAM,KAAK,WAAW,gBAAgB;AAC3D,QAAM,MAAM,cAAc,EAAE,WAAW,MAAM,CAAC;AAC9C,MAAI;AACF,SAAM,MAAM,gBAAgB;AAC5B,SAAM,KAAK,oBAAoB,SAAS,gBAAgB;AACxD,SAAM,KAAK,wBAAwB,iBAAiB,SAAS;AAC7D,OAAI,aACF,OAAM,OAAO,iBAAiB,gBAAgB;AAEhD,SAAM,OAAO,iBAAiB,gBAAgB;AAC9C,SAAM,GAAG,iBAAiB;IAAE,WAAW;IAAM,OAAO;IAAM,CAAC;WACpD,OAAO;AACd,SAAM,GAAG,iBAAiB;IAAE,WAAW;IAAM,OAAO;IAAM,CAAC;AAC3D,OAAI,gBAAgB,MAAM,KAAK,WAAW,gBAAgB,EAAE;AAC1D,UAAM,GAAG,iBAAiB;KAAE,WAAW;KAAM,OAAO;KAAM,CAAC;AAC3D,QAAI;AACF,WAAM,OAAO,iBAAiB,gBAAgB;aACvC,cAAc;AACrB,WAAM,IAAI,eACR,CAAC,OAAO,aAAa,EACrB,0BAA0B,kBAC3B;;;AAGL,SAAM;YACE;AACR,SAAM,GAAG,iBAAiB;IAAE,WAAW;IAAM,OAAO;IAAM,CAAC;AAC3D,SAAM,GAAG,iBAAiB;IAAE,WAAW;IAAM,OAAO;IAAM,CAAC;;;CAI/D,sBAA8B,OAC5B,SACA,oBACkB;AAClB,OAAK,MAAM,CAAC,WAAW,UAAU,OAAO,QAAQ,QAAQ,EAAE;GACxD,MAAM,aAAa,KAAK,KAAK,iBAAiB,UAAU;AACxD,SAAM,MAAM,KAAK,QAAQ,WAAW,EAAE,EAAE,WAAW,MAAM,CAAC;AAC1D,SAAM,UAAU,YAAY,OAAO,KAAK,MAAM,CAAC;;;CAInD,0BAAkC,OAChC,cACA,aACkB;EAClB,MAAM,iBAAiB,MAAM,KAAK,gBAAgB,KAAK,aAAa;AACpE,MACE,SAAS,UAAU,eAAe,SAAS,MAC3C,SAAS,SAAS,eAAe,SAAS,QAC1C,SAAS,YAAY,eAAe,SAAS,QAE7C,OAAM,IAAI,MAAM,yCAAyC;AAE3D,MAAI,eAAe,SAAS,kBAAkB,KAAK,SAAS,qBAAqB,SAC/E,OAAM,IAAI,MAAM,8BAA8B;;CAIlD,sBAA8B,OAC5B,WAC2E;EAC3E,MAAM,YAAY,IAAI,IAAY,CAChC,KAAK,SAAS,OAAO,cAAc,OAAO,aAAa,CAAC,QAAQ,OAAO,IAAI,CAC5E,CAAC;AACF,MAAI,8BAA8B,OAAO,EAAE;AACzC,aAAU,IAAI,KAAK,SAAS,OAAO,cAAc,OAAO,cAAc,CAAC,QAAQ,OAAO,IAAI,CAAC;AAC3F,SAAM,KAAK,sBAAsB,OAAO,iBAAiB,OAAO,cAAc,UAAU;AACxF,SAAM,KAAK,sBAAsB,OAAO,qBAAqB,OAAO,cAAc,UAAU;SACvF;AACL,QAAK,MAAM,aAAa,OAAO,WAC7B,OAAM,KAAK,sBAAsB,UAAU,oBAAoB,OAAO,cAAc,UAAU;AAEhG,SAAM,KAAK,sBAAsB,OAAO,qBAAqB,OAAO,cAAc,UAAU;AAC5F,SAAM,KAAK,gBAAgB,OAAO,cAAc,oBAAoB,UAAU;;AAEhF,MAAI,OAAO,SACT,WAAU,IAAI,KAAK,SAAS,OAAO,cAAc,OAAO,SAAS,CAAC,QAAQ,OAAO,IAAI,CAAC;AAExF,SAAO,MAAM,KAAK,aAAa,OAAO,cAAc,UAAU;;CAGhE,qBAA6B,OAC3B,WAC2E;AAC3E,MAAI,CAAC,8BAA8B,OAAO,CACxC,OAAM,IAAI,MAAM,8BAA8B;EAEhD,MAAM,4BAAY,IAAI,KAAa;AACnC,QAAM,KAAK,4BAA4B,OAAO,cAAc,OAAO,cAAc,UAAU;EAC3F,MAAM,SAAS,MAAM,KAAK,aAAa,OAAO,cAAc,UAAU;AACtE,MAAI,OAAO,SAAS,KAAK,SAAS,sBAChC,QAAO,SAAS,OAAO,SAAS,KAAK,SAAS;AAEhD,SAAO;;CAGT,eAAuB,OACrB,cACA,cAC2E;EAC3E,MAAM,cAAc,MAAM,KAAK,UAAU,CAAC,MAAM,MAAM,UAAU,KAAK,cAAc,MAAM,CAAC;EAC1F,MAAM,WAAuC,EAAE;AAC/C,OAAK,MAAM,gBAAgB,YACzB,UAAS,gBAAgB,IAAI,WAAW,MAAM,SAAS,KAAK,KAAK,cAAc,aAAa,CAAC,CAAC;AAEhG,SAAO;GAAE;GAAU,WAAW;GAAa;;CAG7C,wBAAgC,OAC9B,eACA,cACA,cACkB;AAClB,MAAI;GACF,MAAM,UAAU,MAAM,QAAQ,eAAe,EAAE,eAAe,MAAM,CAAC;AACrE,QAAK,MAAM,SAAS,SAAS;IAC3B,MAAM,YAAY,KAAK,KAAK,eAAe,MAAM,KAAK;IACtD,MAAM,eAAe,KAAK,SAAS,cAAc,UAAU,CAAC,QAAQ,OAAO,IAAI;AAE/E,SADmB,MAAM,MAAM,UAAU,EAC1B,gBAAgB,CAC7B,OAAM,IAAI,MAAM,oBAAoB,eAAe;AAErD,QAAI,MAAM,aAAa,EAAE;AACvB,SAAI,CAAC,KAAK,yBAAyB,aAAa,CAC9C,OAAM,KAAK,sBAAsB,WAAW,cAAc,UAAU;AAEtE;;AAEF,QAAI,MAAM,QAAQ,IAAI,CAAC,KAAK,yBAAyB,aAAa,CAChE,WAAU,IAAI,aAAa;;WAGxB,OAAO;AACd,OAAI,KAAK,mBAAmB,MAAM,CAChC;AAEF,SAAM;;;CAIV,8BAAsC,OACpC,eACA,cACA,cACkB;EAClB,MAAM,UAAU,MAAM,QAAQ,eAAe,EAAE,eAAe,MAAM,CAAC;AACrE,OAAK,MAAM,SAAS,SAAS;GAC3B,MAAM,YAAY,KAAK,KAAK,eAAe,MAAM,KAAK;GACtD,MAAM,eAAe,KAAK,SAAS,cAAc,UAAU,CAAC,QAAQ,OAAO,IAAI;AAE/E,QADmB,MAAM,MAAM,UAAU,EAC1B,gBAAgB,CAC7B,OAAM,IAAI,MAAM,oBAAoB,eAAe;AAErD,OAAI,MAAM,aAAa;QACjB,CAAC,KAAK,wBAAwB,aAAa,CAC7C,OAAM,KAAK,4BAA4B,WAAW,cAAc,UAAU;cAEnE,MAAM,QAAQ,IAAI,CAAC,KAAK,wBAAwB,aAAa,CACtE,WAAU,IAAI,aAAa;;;CAKjC,kBAA0B,OACxB,cACA,cACA,cACkB;AAClB,MAAI;GACF,MAAM,QAAQ,MAAM,MAAM,KAAK,KAAK,cAAc,aAAa,CAAC;AAChE,OAAI,MAAM,QAAQ,IAAI,CAAC,MAAM,gBAAgB,CAC3C,WAAU,IAAI,aAAa;WAEtB,OAAO;AACd,OAAI,CAAC,KAAK,mBAAmB,MAAM,CACjC,OAAM;;;CAKZ,4BAAoC,iBAAkC;AAEpE,SADiB,aAAa,MAAM,IAAI,CACxB,MAAM,YACpB,YAAY,kBACZ,YAAY,UACZ,YAAY,cACZ,YAAY,WACZ,YAAY,eACZ,YAAY,WACb,IAAI,sCAAsC,KAAK,aAAa,IAAI,aAAa,SAAS,OAAO;;CAGhG,2BAAmC,iBAAkC;AACnE,SAAO,KAAK,yBAAyB,aAAa,IAChD,iBAAiB,WAAW,aAAa,WAAW,SAAS,IAC7D,iBAAiB,eAAe,aAAa,WAAW,aAAa,IACrE,iBAAiB,oBAAoB,aAAa,WAAW,kBAAkB;;CAGnF,qBAA6B,UAA4C;EACvE,MAAM,UAAU,OAAO,QAAQ,MAAM;AACrC,MAAI,QAAQ,SAAS,IAAI,eACvB,OAAM,IAAI,MAAM,gBAAgB,eAAe,MAAM;EAEvD,IAAI,aAAa;AACjB,OAAK,MAAM,CAAC,cAAc,UAAU,SAAS;AAC3C,OAAI,MAAM,aAAa,eACrB,OAAM,IAAI,MAAM,gBAAgB,eAAe,YAAY,eAAe;AAE5E,iBAAc,MAAM;;AAEtB,MAAI,aAAa,uBACf,OAAM,IAAI,MAAM,gBAAgB,uBAAuB,YAAY;;CAIvE,oBACE,YAC+B;EAC/B,MAAM,oBAAgD,EAAE;AACxD,OAAK,MAAM,CAAC,WAAW,UAAU,OAAO,QAAQ,QAAQ,EAAE;GACxD,MAAM,kBAAkB,KAAK,sBAAsB,UAAU;AAC7D,OAAI,OAAO,OAAO,mBAAmB,gBAAgB,CACnD,OAAM,IAAI,MAAM,iBAAiB,kBAAkB;AAErD,qBAAkB,mBAAmB;;AAEvC,SAAO;;CAGT,2BACE,YACsB;EACtB,MAAM,MAAM,KAAK,qBACf,SACA,sBACA,kBACD;EACD,MAAM,mBAAmB,IAAI,qBAAqB,KAAA,IAC9C,WACA,IAAI;AACR,MACE,IAAI,wBAAwB,KAC3B,qBAAqB,YAAY,qBAAqB,YACvD,OAAO,IAAI,UAAU,YAAY,CAAC,IAAI,SACtC,OAAO,IAAI,SAAS,YAAY,CAAC,IAAI,QACrC,OAAO,IAAI,YAAY,YAAY,CAAC,IAAI,WACxC,IAAI,kBAAkB,mBACtB,IAAI,kBAAkB,eAEtB,OAAM,IAAI,MAAM,sBAAsB;AAExC,SAAO;GACL,GAAG;GACH;GACD;;CAGH,4BACE,YACuB;EACvB,MAAM,MAAM,KAAK,qBACf,SACA,gBACA,mBACD;AACD,MAAI,IAAI,cAAc,YAAY,CAAC,IAAI,SAAS,OAAO,IAAI,UAAU,SACnE,OAAM,IAAI,MAAM,uBAAuB;AAEzC,SAAO;;CAGT,0BACE,SACA,cACS;EACT,MAAM,cAAc,OAAO,KAAK,QAAQ,CACrC,QAAQ,UAAU,UAAU,eAAe,CAC3C,MAAM,MAAM,UAAU,KAAK,cAAc,MAAM,CAAC;EACnD,MAAM,gBAAgB,OAAO,KAAK,UAAU,MAAM,CAC/C,KAAK,UAAU,KAAK,sBAAsB,MAAM,CAAC,CACjD,MAAM,MAAM,UAAU,KAAK,cAAc,MAAM,CAAC;AACnD,MACE,YAAY,WAAW,cAAc,UACrC,YAAY,MAAM,OAAO,UAAU,UAAU,cAAc,OAAO,CAElE,OAAM,IAAI,MAAM,yCAAyC;AAE3D,OAAK,MAAM,gBAAgB,aAAa;GACtC,MAAM,eAAe,UAAU,MAAM;AACrC,OAAI,CAAC,gBAAgB,CAAC,iBAAiB,KAAK,aAAa,CACvD,OAAM,IAAI,MAAM,wBAAwB,eAAe;AAGzD,OADmB,KAAK,cAAc,QAAQ,cAA4B,KACvD,aACjB,OAAM,IAAI,MAAM,wBAAwB,eAAe;;;CAK7D,wBACE,SACA,WACA,UACM;EACN,MAAM,QAAQ,QAAQ;AACtB,MAAI,CAAC,MACH,OAAM,IAAI,MAAM,aAAa,MAAM,GAAG;AAExC,MAAI;AACF,UAAO,KAAK,MAAM,OAAO,KAAK,MAAM,CAAC,SAAS,QAAQ,CAAC;WAChD,OAAO;AACd,SAAM,IAAI,MAAM,QAAQ,MAAM,GAAG,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,GAAG;;;CAI9F,iBACE,OACA,MACA,SACA,sBACuB;EACvB,qBAAqB;EACrB;EACA;EACA;EACA;EACA,eAAe;EACf,eAAe;EAChB;CAED,kBAA0B,WAA2D;EACnF,WAAW;EACX,OAAO,OAAO,YACZ,OAAO,QAAQ,MAAM,CAClB,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,cAAc,MAAM,CAAC,CACpD,KAAK,CAAC,cAAc,eAAe,CAAC,cAAc,KAAK,cAAc,UAAU,CAAC,CAAC,CACrF;EACF;CAED,iBAAyB,cACvB,WAAW,SAAS,CAAC,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,OAAO,MAAM;CAEnE,2BAAmC,UACjC,MAAM,QAAQ,qBAAqB,IAAI;CAEzC,yBAAiC,cAA8B;EAC7D,MAAM,aAAa,UAAU,QAAQ,OAAO,IAAI;EAChD,MAAM,WAAW,WAAW,MAAM,IAAI;AACtC,MACE,CAAC,cAAc,WAAW,WAAW,IAAI,IAAI,WAAW,SAAS,KAAK,IACtE,aAAa,KAAK,WAAW,IAC7B,SAAS,MAAM,YAAY,CAAC,WAAW,YAAY,OAAO,YAAY,KAAK,CAE3E,OAAM,IAAI,MAAM,kBAAkB,YAAY;AAEhD,SAAO,SAAS,KAAK,IAAI;;CAG3B,sBAA8B,UAC5B,OAAO,UAAU,YAAY,UAAU,QACvC,UAAU,SAAU,MAA6B,SAAS;CAE5D,aAAqB,OAAO,eAAyC;AACnE,MAAI;AACF,SAAM,OAAO,WAAW;AACxB,UAAO;UACD;AACN,UAAO;;;;AAKb,MAAM,gCAAgC,WAAW,KAC/C,OAAO,KACL,gFACA,SACD,CACF"}

package/dist/{permissions → services}/app-grant.service.d.ts

@@ -1,8 +1,8 @@
-import { AppManifestService } from "../manifest/app-manifest.service.js";
-import { AppDocumentGrantMutationResult, AppInstalledPermissionState } from "./app-permissions.types.js";
-import { AppRegistryService } from "../registry/app-registry.service.js";
+import { AppManifestService } from "./app-manifest.service.js";
+import { AppDocumentGrantMutationResult, AppInstalledPermissionState } from "../types/app-permissions.types.js";
+import { AppRegistryService } from "./app-registry.service.js";
 
-//#region src/permissions/app-grant.service.d.ts
+//#region src/services/app-grant.service.d.ts
 declare class AppGrantService {
   private readonly registryService;
   private readonly manifestService;

package/dist/services/app-grant.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-grant.service.d.ts","names":[],"sources":["../../src/services/app-grant.service.ts"],"mappings":";;;;;cAUa,eAAA;EAAA,iBAEQ,eAAA;EAAA,iBACA,eAAA;cADA,eAAA,GAAiB,kBAAA,EACjB,eAAA,GAAiB,kBAAA;EAGpC,SAAA,GAAmB,KAAA,aAAgB,OAAA,CAAQ,2BAAA;EAyC3C,kBAAA,GAA4B,MAAA;IAC1B,KAAA;IACA,OAAA;IACA,aAAA;EAAA,MACE,OAAA,CAAQ,8BAAA;EA2BZ,mBAAA,GAA6B,MAAA;IAC3B,KAAA;IACA,OAAA;EAAA,MACE,OAAA,CAAQ,8BAAA;AAAA"}

package/dist/{permissions → services}/app-grant.service.js

@@ -1,8 +1,9 @@
-import { AppManifestService } from "../manifest/app-manifest.service.js";
-import { AppRegistryService } from "../registry/app-registry.service.js";
+import { AppManifestService } from "./app-manifest.service.js";
+import { isAppStandaloneManifestBundle } from "../types/app-manifest.types.js";
+import { AppRegistryService } from "./app-registry.service.js";
 import { access } from "node:fs/promises";
 import path from "node:path";
-//#region src/permissions/app-grant.service.ts
+//#region src/services/app-grant.service.ts
 var AppGrantService = class {
 	constructor(registryService = new AppRegistryService(), manifestService = new AppManifestService()) {
 		this.registryService = registryService;
@@ -13,7 +14,9 @@ var AppGrantService = class {
 		if (!appRecord) throw new Error(`未找到已安装应用：${appId}`);
 		const activeVersion = appRecord.installedVersions[appRecord.activeVersion];
 		if (!activeVersion) throw new Error(`已安装应用缺少激活版本：${appId}`);
-		const requestedPermissions = (await this.manifestService.load(activeVersion.installDirectory)).manifest.permissions ?? {};
+		const bundle = await this.manifestService.load(activeVersion.installDirectory);
+		if (!isAppStandaloneManifestBundle(bundle)) throw new Error("schema v2 组合包权限由 Panel/Service runtime grant 管理。");
+		const requestedPermissions = bundle.manifest.permissions ?? {};
 		return {
 			appId: appRecord.appId,
 			name: appRecord.name,

package/dist/services/app-grant.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-grant.service.js","names":[],"sources":["../../src/services/app-grant.service.ts"],"sourcesContent":["import { access } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { AppManifestService } from \"#app-runtime/services/app-manifest.service.js\";\nimport { isAppStandaloneManifestBundle } from \"#app-runtime/types/app-manifest.types.js\";\nimport { AppRegistryService } from \"#app-runtime/services/app-registry.service.js\";\nimport type {\n  AppDocumentGrantMutationResult,\n  AppInstalledPermissionState,\n} from \"#app-runtime/types/app-permissions.types.js\";\n\nexport class AppGrantService {\n  constructor(\n    private readonly registryService: AppRegistryService = new AppRegistryService(),\n    private readonly manifestService: AppManifestService = new AppManifestService(),\n  ) {}\n\n  summarize = async (appId: string): Promise<AppInstalledPermissionState> => {\n    const appRecord = await this.registryService.getApp(appId);\n    if (!appRecord) {\n      throw new Error(`未找到已安装应用：${appId}`);\n    }\n    const activeVersion = appRecord.installedVersions[appRecord.activeVersion];\n    if (!activeVersion) {\n      throw new Error(`已安装应用缺少激活版本：${appId}`);\n    }\n    const bundle = await this.manifestService.load(activeVersion.installDirectory);\n    if (!isAppStandaloneManifestBundle(bundle)) {\n      throw new Error(\"schema v2 组合包权限由 Panel/Service runtime grant 管理。\");\n    }\n    const requestedPermissions = bundle.manifest.permissions ?? {};\n    return {\n      appId: appRecord.appId,\n      name: appRecord.name,\n      activeVersion: appRecord.activeVersion,\n      documentAccess: (requestedPermissions.documentAccess ?? []).map((scope) => ({\n        id: scope.id,\n        mode: scope.mode,\n        description: scope.description,\n        granted: Boolean(appRecord.grants[scope.id]),\n        grantedPath: appRecord.grants[scope.id],\n      })),\n      allowedDomains: requestedPermissions.allowedDomains ?? [],\n      storage: {\n        enabled:\n          requestedPermissions.storage !== undefined &&\n          requestedPermissions.storage !== false,\n        namespace:\n          typeof requestedPermissions.storage === \"object\"\n            ? requestedPermissions.storage.namespace\n            : undefined,\n      },\n      capabilities: {\n        hostBridge: requestedPermissions.capabilities?.hostBridge !== false,\n      },\n    };\n  };\n\n  grantDocumentScope = async (params: {\n    appId: string;\n    scopeId: string;\n    directoryPath: string;\n  }): Promise<AppDocumentGrantMutationResult> => {\n    const { appId, scopeId, directoryPath } = params;\n    const permissionState = await this.summarize(appId);\n    const requestedScope = permissionState.documentAccess.find(\n      (scope) => scope.id === scopeId,\n    );\n    if (!requestedScope) {\n      throw new Error(`应用 ${appId} 未声明 documentAccess scope：${scopeId}`);\n    }\n    const normalizedDirectory = path.resolve(directoryPath);\n    try {\n      await access(normalizedDirectory);\n    } catch {\n      throw new Error(`授权目录不存在：${normalizedDirectory}`);\n    }\n    await this.registryService.setDocumentGrant(\n      appId,\n      scopeId,\n      normalizedDirectory,\n    );\n    return {\n      appId,\n      scopeId,\n      grantedPath: normalizedDirectory,\n    };\n  };\n\n  revokeDocumentScope = async (params: {\n    appId: string;\n    scopeId: string;\n  }): Promise<AppDocumentGrantMutationResult> => {\n    const { appId, scopeId } = params;\n    await this.summarize(appId);\n    const removed = await this.registryService.removeDocumentGrant(\n      appId,\n      scopeId,\n    );\n    return {\n      appId,\n      scopeId,\n      removed,\n    };\n  };\n}\n"],"mappings":";;;;;;AAUA,IAAa,kBAAb,MAA6B;CAC3B,YACE,kBAAuD,IAAI,oBAAoB,EAC/E,kBAAuD,IAAI,oBAAoB,EAC/E;AAFiB,OAAA,kBAAA;AACA,OAAA,kBAAA;;CAGnB,YAAY,OAAO,UAAwD;EACzE,MAAM,YAAY,MAAM,KAAK,gBAAgB,OAAO,MAAM;AAC1D,MAAI,CAAC,UACH,OAAM,IAAI,MAAM,YAAY,QAAQ;EAEtC,MAAM,gBAAgB,UAAU,kBAAkB,UAAU;AAC5D,MAAI,CAAC,cACH,OAAM,IAAI,MAAM,eAAe,QAAQ;EAEzC,MAAM,SAAS,MAAM,KAAK,gBAAgB,KAAK,cAAc,iBAAiB;AAC9E,MAAI,CAAC,8BAA8B,OAAO,CACxC,OAAM,IAAI,MAAM,mDAAmD;EAErE,MAAM,uBAAuB,OAAO,SAAS,eAAe,EAAE;AAC9D,SAAO;GACL,OAAO,UAAU;GACjB,MAAM,UAAU;GAChB,eAAe,UAAU;GACzB,iBAAiB,qBAAqB,kBAAkB,EAAE,EAAE,KAAK,WAAW;IAC1E,IAAI,MAAM;IACV,MAAM,MAAM;IACZ,aAAa,MAAM;IACnB,SAAS,QAAQ,UAAU,OAAO,MAAM,IAAI;IAC5C,aAAa,UAAU,OAAO,MAAM;IACrC,EAAE;GACH,gBAAgB,qBAAqB,kBAAkB,EAAE;GACzD,SAAS;IACP,SACE,qBAAqB,YAAY,KAAA,KACjC,qBAAqB,YAAY;IACnC,WACE,OAAO,qBAAqB,YAAY,WACpC,qBAAqB,QAAQ,YAC7B,KAAA;IACP;GACD,cAAc,EACZ,YAAY,qBAAqB,cAAc,eAAe,OAC/D;GACF;;CAGH,qBAAqB,OAAO,WAImB;EAC7C,MAAM,EAAE,OAAO,SAAS,kBAAkB;AAK1C,MAAI,EAJoB,MAAM,KAAK,UAAU,MAAM,EACZ,eAAe,MACnD,UAAU,MAAM,OAAO,QACzB,CAEC,OAAM,IAAI,MAAM,MAAM,MAAM,4BAA4B,UAAU;EAEpE,MAAM,sBAAsB,KAAK,QAAQ,cAAc;AACvD,MAAI;AACF,SAAM,OAAO,oBAAoB;UAC3B;AACN,SAAM,IAAI,MAAM,WAAW,sBAAsB;;AAEnD,QAAM,KAAK,gBAAgB,iBACzB,OACA,SACA,oBACD;AACD,SAAO;GACL;GACA;GACA,aAAa;GACd;;CAGH,sBAAsB,OAAO,WAGkB;EAC7C,MAAM,EAAE,OAAO,YAAY;AAC3B,QAAM,KAAK,UAAU,MAAM;AAK3B,SAAO;GACL;GACA;GACA,SAPc,MAAM,KAAK,gBAAgB,oBACzC,OACA,QACD;GAKA"}

package/dist/{paths → services}/app-home.service.d.ts

@@ -1,4 +1,4 @@
-//#region src/paths/app-home.service.d.ts
+//#region src/services/app-home.service.d.ts
 declare class AppHomeService {
   private readonly appHomeDirectory;
   constructor(appHomeDirectory?: string);

package/dist/services/app-home.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-home.service.d.ts","names":[],"sources":["../../src/services/app-home.service.ts"],"mappings":";cAIa,cAAA;EAAA,iBAEQ,gBAAA;cAAA,gBAAA;EAKnB,mBAAA;EAIA,oBAAA;EAIA,gBAAA;EAIA,eAAA;EAIA,aAAA;EAIA,mBAAA,GAAuB,KAAA,UAAe,OAAA;EAItC,mBAAA,GAAuB,KAAA;EAIvB,qBAAA,QAAkC,OAAA;EAQlC,wBAAA,GAAkC,MAAA,aAAiB,OAAA;AAAA"}

package/dist/{paths → services}/app-home.service.js

@@ -1,7 +1,7 @@
 import { mkdir, mkdtemp } from "node:fs/promises";
 import path from "node:path";
 import { tmpdir } from "node:os";
-//#region src/paths/app-home.service.ts
+//#region src/services/app-home.service.ts
 var AppHomeService = class {
 	constructor(appHomeDirectory = process.env.NEXTCLAW_APP_HOME ? path.resolve(process.env.NEXTCLAW_APP_HOME) : path.join(process.env.HOME ?? process.cwd(), ".nextclaw", "apps")) {
 		this.appHomeDirectory = appHomeDirectory;

package/dist/services/app-home.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-home.service.js","names":[],"sources":["../../src/services/app-home.service.ts"],"sourcesContent":["import { mkdir, mkdtemp } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport path from \"node:path\";\n\nexport class AppHomeService {\n  constructor(\n    private readonly appHomeDirectory: string = process.env.NEXTCLAW_APP_HOME\n      ? path.resolve(process.env.NEXTCLAW_APP_HOME)\n      : path.join(process.env.HOME ?? process.cwd(), \".nextclaw\", \"apps\"),\n  ) {}\n\n  getAppHomeDirectory = (): string => {\n    return this.appHomeDirectory;\n  };\n\n  getPackagesDirectory = (): string => {\n    return path.join(this.appHomeDirectory, \"packages\");\n  };\n\n  getDataDirectory = (): string => {\n    return path.join(this.appHomeDirectory, \"data\");\n  };\n\n  getRegistryPath = (): string => {\n    return path.join(this.appHomeDirectory, \"registry.json\");\n  };\n\n  getConfigPath = (): string => {\n    return path.join(this.appHomeDirectory, \"config.json\");\n  };\n\n  getInstallDirectory = (appId: string, version: string): string => {\n    return path.join(this.getPackagesDirectory(), appId, version);\n  };\n\n  getAppDataDirectory = (appId: string): string => {\n    return path.join(this.getDataDirectory(), appId);\n  };\n\n  ensureBaseDirectories = async (): Promise<void> => {\n    await Promise.all([\n      mkdir(this.appHomeDirectory, { recursive: true }),\n      mkdir(this.getPackagesDirectory(), { recursive: true }),\n      mkdir(this.getDataDirectory(), { recursive: true }),\n    ]);\n  };\n\n  createTemporaryDirectory = async (prefix: string): Promise<string> => {\n    return mkdtemp(path.join(tmpdir(), prefix));\n  };\n}\n"],"mappings":";;;;AAIA,IAAa,iBAAb,MAA4B;CAC1B,YACE,mBAA4C,QAAQ,IAAI,oBACpD,KAAK,QAAQ,QAAQ,IAAI,kBAAkB,GAC3C,KAAK,KAAK,QAAQ,IAAI,QAAQ,QAAQ,KAAK,EAAE,aAAa,OAAO,EACrE;AAHiB,OAAA,mBAAA;;CAKnB,4BAAoC;AAClC,SAAO,KAAK;;CAGd,6BAAqC;AACnC,SAAO,KAAK,KAAK,KAAK,kBAAkB,WAAW;;CAGrD,yBAAiC;AAC/B,SAAO,KAAK,KAAK,KAAK,kBAAkB,OAAO;;CAGjD,wBAAgC;AAC9B,SAAO,KAAK,KAAK,KAAK,kBAAkB,gBAAgB;;CAG1D,sBAA8B;AAC5B,SAAO,KAAK,KAAK,KAAK,kBAAkB,cAAc;;CAGxD,uBAAuB,OAAe,YAA4B;AAChE,SAAO,KAAK,KAAK,KAAK,sBAAsB,EAAE,OAAO,QAAQ;;CAG/D,uBAAuB,UAA0B;AAC/C,SAAO,KAAK,KAAK,KAAK,kBAAkB,EAAE,MAAM;;CAGlD,wBAAwB,YAA2B;AACjD,QAAM,QAAQ,IAAI;GAChB,MAAM,KAAK,kBAAkB,EAAE,WAAW,MAAM,CAAC;GACjD,MAAM,KAAK,sBAAsB,EAAE,EAAE,WAAW,MAAM,CAAC;GACvD,MAAM,KAAK,kBAAkB,EAAE,EAAE,WAAW,MAAM,CAAC;GACpD,CAAC;;CAGJ,2BAA2B,OAAO,WAAoC;AACpE,SAAO,QAAQ,KAAK,KAAK,QAAQ,EAAE,OAAO,CAAC"}

package/dist/{host → services}/app-host.service.d.ts

@@ -1,7 +1,7 @@
 import { AppInstanceService } from "./app-instance.service.js";
-import { WasmtimeWasiHttpComponentService } from "../runtime/wasmtime-wasi-http-component.service.js";
+import { WasmtimeWasiHttpComponentService } from "./wasmtime-wasi-http-component.service.js";
 
-//#region src/host/app-host.service.d.ts
+//#region src/services/app-host.service.d.ts
 type AppHostStartOptions = {
   host: string;
   port: number;

package/dist/services/app-host.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-host.service.d.ts","names":[],"sources":["../../src/services/app-host.service.ts"],"mappings":";;;;KAMY,mBAAA;EACV,IAAA;EACA,IAAA;AAAA;AAAA,KAGU,aAAA;EACV,KAAA;EACA,GAAA;EACA,IAAA;EACA,IAAA;AAAA;AAAA,cAGW,cAAA;EAAA,iBAMQ,WAAA;EAAA,iBACA,wBAAA;EAAA,QANX,MAAA;EAAA,iBACS,YAAA;EAAA,iBACA,QAAA;cAGE,WAAA,EAAa,kBAAA,EACb,wBAAA,GAA2B,gCAAA;EAM9C,KAAA,GAAe,OAAA,EAAS,mBAAA,KAAsB,OAAA,CAAQ,aAAA;EA2BtD,IAAA,QAAiB,OAAA;EAAA,QAgBT,aAAA;AAAA"}

package/dist/{host → services}/app-host.service.js

@@ -1,7 +1,7 @@
-import { HostBridgeServer } from "../bridge/host-bridge.service.js";
-import { UiServerService } from "../ui/ui-server.service.js";
+import { HostBridgeServer } from "./host-bridge.service.js";
+import { UiServerService } from "./ui-server.service.js";
 import { createServer } from "node:http";
-//#region src/host/app-host.service.ts
+//#region src/services/app-host.service.ts
 var AppHostService = class {
 	server;
 	bridgeServer;

package/dist/services/app-host.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-host.service.js","names":[],"sources":["../../src/services/app-host.service.ts"],"sourcesContent":["import { createServer, type IncomingMessage, type Server, type ServerResponse } from \"node:http\";\nimport { HostBridgeServer } from \"#app-runtime/services/host-bridge.service.js\";\nimport type { AppInstanceService } from \"./app-instance.service.js\";\nimport { UiServerService } from \"#app-runtime/services/ui-server.service.js\";\nimport type { WasmtimeWasiHttpComponentService } from \"#app-runtime/services/wasmtime-wasi-http-component.service.js\";\n\nexport type AppHostStartOptions = {\n  host: string;\n  port: number;\n};\n\nexport type AppHostHandle = {\n  appId: string;\n  url: string;\n  host: string;\n  port: number;\n};\n\nexport class AppHostService {\n  private server?: Server;\n  private readonly bridgeServer: HostBridgeServer;\n  private readonly uiServer: UiServerService;\n\n  constructor(\n    private readonly appInstance: AppInstanceService,\n    private readonly wasiHttpComponentService?: WasmtimeWasiHttpComponentService,\n  ) {\n    this.bridgeServer = new HostBridgeServer(appInstance);\n    this.uiServer = new UiServerService(appInstance.bundle);\n  }\n\n  start = async (options: AppHostStartOptions): Promise<AppHostHandle> => {\n    if (this.server) {\n      throw new Error(\"应用宿主已经启动。\");\n    }\n    const server = createServer((request, response) => {\n      void this.handleRequest(request, response);\n    });\n    this.server = server;\n    await new Promise<void>((resolve, reject) => {\n      server.once(\"error\", reject);\n      server.listen(options.port, options.host, () => {\n        server.off(\"error\", reject);\n        resolve();\n      });\n    });\n    const address = server.address();\n    if (!address || typeof address === \"string\") {\n      throw new Error(\"无法获取应用宿主监听地址。\");\n    }\n    return {\n      appId: this.appInstance.bundle.manifest.id,\n      url: `http://${address.address}:${address.port}`,\n      host: address.address,\n      port: address.port,\n    };\n  };\n\n  stop = async (): Promise<void> => {\n    if (!this.server) {\n      return;\n    }\n    await new Promise<void>((resolve, reject) => {\n      this.server?.close((error) => {\n        if (error) {\n          reject(error);\n          return;\n        }\n        resolve();\n      });\n    });\n    this.server = undefined;\n  };\n\n  private handleRequest = async (\n    request: IncomingMessage,\n    response: ServerResponse,\n  ): Promise<void> => {\n    try {\n      if (this.wasiHttpComponentService) {\n        const backendHandled = await this.wasiHttpComponentService.handleRequest(request, response);\n        if (backendHandled) {\n          return;\n        }\n      }\n      const bridgeHandled = await this.bridgeServer.handle(request, response);\n      if (bridgeHandled) {\n        return;\n      }\n      await this.uiServer.handle(request, response);\n    } catch (error) {\n      response.writeHead(500, {\n        \"content-type\": \"application/json; charset=utf-8\",\n      });\n      response.end(\n        JSON.stringify(\n          {\n            ok: false,\n            error: {\n              code: \"APP_HOST_ERROR\",\n              message: error instanceof Error ? error.message : String(error),\n            },\n          },\n          null,\n          2,\n        ),\n      );\n    }\n  };\n}\n"],"mappings":";;;;AAkBA,IAAa,iBAAb,MAA4B;CAC1B;CACA;CACA;CAEA,YACE,aACA,0BACA;AAFiB,OAAA,cAAA;AACA,OAAA,2BAAA;AAEjB,OAAK,eAAe,IAAI,iBAAiB,YAAY;AACrD,OAAK,WAAW,IAAI,gBAAgB,YAAY,OAAO;;CAGzD,QAAQ,OAAO,YAAyD;AACtE,MAAI,KAAK,OACP,OAAM,IAAI,MAAM,YAAY;EAE9B,MAAM,SAAS,cAAc,SAAS,aAAa;AAC5C,QAAK,cAAc,SAAS,SAAS;IAC1C;AACF,OAAK,SAAS;AACd,QAAM,IAAI,SAAe,SAAS,WAAW;AAC3C,UAAO,KAAK,SAAS,OAAO;AAC5B,UAAO,OAAO,QAAQ,MAAM,QAAQ,YAAY;AAC9C,WAAO,IAAI,SAAS,OAAO;AAC3B,aAAS;KACT;IACF;EACF,MAAM,UAAU,OAAO,SAAS;AAChC,MAAI,CAAC,WAAW,OAAO,YAAY,SACjC,OAAM,IAAI,MAAM,gBAAgB;AAElC,SAAO;GACL,OAAO,KAAK,YAAY,OAAO,SAAS;GACxC,KAAK,UAAU,QAAQ,QAAQ,GAAG,QAAQ;GAC1C,MAAM,QAAQ;GACd,MAAM,QAAQ;GACf;;CAGH,OAAO,YAA2B;AAChC,MAAI,CAAC,KAAK,OACR;AAEF,QAAM,IAAI,SAAe,SAAS,WAAW;AAC3C,QAAK,QAAQ,OAAO,UAAU;AAC5B,QAAI,OAAO;AACT,YAAO,MAAM;AACb;;AAEF,aAAS;KACT;IACF;AACF,OAAK,SAAS,KAAA;;CAGhB,gBAAwB,OACtB,SACA,aACkB;AAClB,MAAI;AACF,OAAI,KAAK;QACgB,MAAM,KAAK,yBAAyB,cAAc,SAAS,SAAS,CAEzF;;AAIJ,OADsB,MAAM,KAAK,aAAa,OAAO,SAAS,SAAS,CAErE;AAEF,SAAM,KAAK,SAAS,OAAO,SAAS,SAAS;WACtC,OAAO;AACd,YAAS,UAAU,KAAK,EACtB,gBAAgB,mCACjB,CAAC;AACF,YAAS,IACP,KAAK,UACH;IACE,IAAI;IACJ,OAAO;KACL,MAAM;KACN,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;KAChE;IACF,EACD,MACA,EACD,CACF"}

package/dist/services/app-install-source.service.js

@@ -0,0 +1,72 @@
+import { access } from "node:fs/promises";
+import path from "node:path";
+//#region src/services/app-install-source.service.ts
+var AppInstallSourceService = class {
+	constructor(manifestService, remoteRegistryClient) {
+		this.manifestService = manifestService;
+		this.remoteRegistryClient = remoteRegistryClient;
+	}
+	resolve = async (appSource, registryUrl) => {
+		const localSource = await this.detectLocal(appSource);
+		if (localSource.kind === "directory") return {
+			kind: "directory",
+			appDirectory: localSource.appDirectory,
+			sourceRef: localSource.appDirectory
+		};
+		if (localSource.kind === "bundle") return {
+			kind: "bundle",
+			bundlePath: localSource.bundlePath,
+			sourceRef: localSource.bundlePath
+		};
+		const registrySpec = this.parseRegistrySpec(appSource);
+		if (!registrySpec) {
+			if (this.looksLikePath(appSource)) throw new Error(`本地安装源不存在：${appSource}`);
+			throw new Error(`无法识别安装源：${appSource}`);
+		}
+		const registryResolution = await this.remoteRegistryClient.resolve({
+			appId: registrySpec.appId,
+			version: registrySpec.version,
+			registryUrl
+		});
+		return {
+			kind: "registry",
+			sourceRef: `${registryResolution.appId}@${registryResolution.version}`,
+			registryResolution
+		};
+	};
+	detectLocal = async (sourcePath, allowBundle = true) => {
+		const normalizedSource = path.resolve(sourcePath);
+		try {
+			await access(normalizedSource);
+			if ((await this.manifestService.load(normalizedSource)).appDirectory) return {
+				kind: "directory",
+				appDirectory: normalizedSource
+			};
+		} catch {
+			if (allowBundle && normalizedSource.endsWith(".napp")) try {
+				await access(normalizedSource);
+				return {
+					kind: "bundle",
+					bundlePath: normalizedSource
+				};
+			} catch {
+				return { kind: "missing" };
+			}
+			return { kind: "missing" };
+		}
+		return { kind: "missing" };
+	};
+	parseRegistrySpec = (appSource) => {
+		const match = /^(?<appId>[a-z0-9][a-z0-9._-]*)(?:@(?<version>[A-Za-z0-9._+-]+))?$/i.exec(appSource.trim());
+		if (!match?.groups?.appId) return;
+		return {
+			appId: match.groups.appId,
+			version: match.groups.version
+		};
+	};
+	looksLikePath = (appSource) => appSource.startsWith(".") || appSource.startsWith("/") || appSource.includes(path.sep);
+};
+//#endregion
+export { AppInstallSourceService };
+
+//# sourceMappingURL=app-install-source.service.js.map

package/dist/services/app-install-source.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-install-source.service.js","names":[],"sources":["../../src/services/app-install-source.service.ts"],"sourcesContent":["import { access } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport type { AppManifestService } from \"#app-runtime/services/app-manifest.service.js\";\nimport type { AppRemoteRegistryClientService } from \"#app-runtime/services/app-remote-registry-client.service.js\";\n\ntype LocalAppSource =\n  | { kind: \"directory\"; appDirectory: string }\n  | { kind: \"bundle\"; bundlePath: string }\n  | { kind: \"missing\" };\n\nexport type ResolvedAppInstallSource =\n  | {\n      kind: \"directory\";\n      appDirectory: string;\n      sourceRef: string;\n    }\n  | {\n      kind: \"bundle\";\n      bundlePath: string;\n      sourceRef: string;\n    }\n  | {\n      kind: \"registry\";\n      sourceRef: string;\n      registryResolution: Awaited<ReturnType<AppRemoteRegistryClientService[\"resolve\"]>>;\n    };\n\nexport class AppInstallSourceService {\n  constructor(\n    private readonly manifestService: AppManifestService,\n    private readonly remoteRegistryClient: AppRemoteRegistryClientService,\n  ) {}\n\n  resolve = async (\n    appSource: string,\n    registryUrl?: string,\n  ): Promise<ResolvedAppInstallSource> => {\n    const localSource = await this.detectLocal(appSource);\n    if (localSource.kind === \"directory\") {\n      return {\n        kind: \"directory\",\n        appDirectory: localSource.appDirectory,\n        sourceRef: localSource.appDirectory,\n      };\n    }\n    if (localSource.kind === \"bundle\") {\n      return {\n        kind: \"bundle\",\n        bundlePath: localSource.bundlePath,\n        sourceRef: localSource.bundlePath,\n      };\n    }\n    const registrySpec = this.parseRegistrySpec(appSource);\n    if (!registrySpec) {\n      if (this.looksLikePath(appSource)) {\n        throw new Error(`本地安装源不存在：${appSource}`);\n      }\n      throw new Error(`无法识别安装源：${appSource}`);\n    }\n    const registryResolution = await this.remoteRegistryClient.resolve({\n      appId: registrySpec.appId,\n      version: registrySpec.version,\n      registryUrl,\n    });\n    return {\n      kind: \"registry\",\n      sourceRef: `${registryResolution.appId}@${registryResolution.version}`,\n      registryResolution,\n    };\n  };\n\n  detectLocal = async (\n    sourcePath: string,\n    allowBundle: boolean = true,\n  ): Promise<LocalAppSource> => {\n    const normalizedSource = path.resolve(sourcePath);\n    try {\n      await access(normalizedSource);\n      const manifestBundle = await this.manifestService.load(normalizedSource);\n      if (manifestBundle.appDirectory) {\n        return {\n          kind: \"directory\",\n          appDirectory: normalizedSource,\n        };\n      }\n    } catch {\n      if (allowBundle && normalizedSource.endsWith(\".napp\")) {\n        try {\n          await access(normalizedSource);\n          return {\n            kind: \"bundle\",\n            bundlePath: normalizedSource,\n          };\n        } catch {\n          return { kind: \"missing\" };\n        }\n      }\n      return { kind: \"missing\" };\n    }\n    return { kind: \"missing\" };\n  };\n\n  private parseRegistrySpec = (\n    appSource: string,\n  ): { appId: string; version?: string } | undefined => {\n    const match = /^(?<appId>[a-z0-9][a-z0-9._-]*)(?:@(?<version>[A-Za-z0-9._+-]+))?$/i.exec(\n      appSource.trim(),\n    );\n    if (!match?.groups?.appId) {\n      return undefined;\n    }\n    return {\n      appId: match.groups.appId,\n      version: match.groups.version,\n    };\n  };\n\n  private looksLikePath = (appSource: string): boolean =>\n    appSource.startsWith(\".\") ||\n    appSource.startsWith(\"/\") ||\n    appSource.includes(path.sep);\n}\n"],"mappings":";;;AA2BA,IAAa,0BAAb,MAAqC;CACnC,YACE,iBACA,sBACA;AAFiB,OAAA,kBAAA;AACA,OAAA,uBAAA;;CAGnB,UAAU,OACR,WACA,gBACsC;EACtC,MAAM,cAAc,MAAM,KAAK,YAAY,UAAU;AACrD,MAAI,YAAY,SAAS,YACvB,QAAO;GACL,MAAM;GACN,cAAc,YAAY;GAC1B,WAAW,YAAY;GACxB;AAEH,MAAI,YAAY,SAAS,SACvB,QAAO;GACL,MAAM;GACN,YAAY,YAAY;GACxB,WAAW,YAAY;GACxB;EAEH,MAAM,eAAe,KAAK,kBAAkB,UAAU;AACtD,MAAI,CAAC,cAAc;AACjB,OAAI,KAAK,cAAc,UAAU,CAC/B,OAAM,IAAI,MAAM,YAAY,YAAY;AAE1C,SAAM,IAAI,MAAM,WAAW,YAAY;;EAEzC,MAAM,qBAAqB,MAAM,KAAK,qBAAqB,QAAQ;GACjE,OAAO,aAAa;GACpB,SAAS,aAAa;GACtB;GACD,CAAC;AACF,SAAO;GACL,MAAM;GACN,WAAW,GAAG,mBAAmB,MAAM,GAAG,mBAAmB;GAC7D;GACD;;CAGH,cAAc,OACZ,YACA,cAAuB,SACK;EAC5B,MAAM,mBAAmB,KAAK,QAAQ,WAAW;AACjD,MAAI;AACF,SAAM,OAAO,iBAAiB;AAE9B,QADuB,MAAM,KAAK,gBAAgB,KAAK,iBAAiB,EACrD,aACjB,QAAO;IACL,MAAM;IACN,cAAc;IACf;UAEG;AACN,OAAI,eAAe,iBAAiB,SAAS,QAAQ,CACnD,KAAI;AACF,UAAM,OAAO,iBAAiB;AAC9B,WAAO;KACL,MAAM;KACN,YAAY;KACb;WACK;AACN,WAAO,EAAE,MAAM,WAAW;;AAG9B,UAAO,EAAE,MAAM,WAAW;;AAE5B,SAAO,EAAE,MAAM,WAAW;;CAG5B,qBACE,cACoD;EACpD,MAAM,QAAQ,sEAAsE,KAClF,UAAU,MAAM,CACjB;AACD,MAAI,CAAC,OAAO,QAAQ,MAClB;AAEF,SAAO;GACL,OAAO,MAAM,OAAO;GACpB,SAAS,MAAM,OAAO;GACvB;;CAGH,iBAAyB,cACvB,UAAU,WAAW,IAAI,IACzB,UAAU,WAAW,IAAI,IACzB,UAAU,SAAS,KAAK,IAAI"}